> An attack on a root ca can no longer reveal keys useful in eavesdropping on key exchange, but it could reveal keys useful for carrying out a man in the middle

> An attack on a root ca can no longer reveal keys useful in eavesdropping on key exchange, but it could reveal keys useful for carrying out a man in the middle attack This is already the case - if you compromise a CA you can sign certificates for any domain you'd like, enabling you to pull off active MitM attacks, but you can't passively eavesdrop anything. Private keys are not registered with CAs; rather, public keys are submitted to get signed. While the CA system majorly sucks, and needs to be fixed, I don't think it's the answer to mass surveillance, at least in the US. Even if the NSA could sign any certificate they wanted, it seems extremely difficult to pull off active MitM attacks for every connection across the entire Internet. An easier approach is to attack the endpoints (Google, Facebook, etc.) which they're allegedly already doing with PRISM. SSL/TLS can't protect against that.